CVE-2026-3655

Vulnerability

The OTP Login With Phone Number plugin for WordPress versions 1.8.50 to 1.8.60 contains an authentication bypass vulnerability in the lwp_ajax_register AJAX handler. The function idehweb_lwp_activate_through_firebase() validates a Firebase OTP session, but the phoneNumber returned by Firebase is never compared with the victim's stored phone number. This allows an attacker to supply any user's phone number in the request while using their own Firebase OTP session, bypassing authentication [1][3].

Exploitation

An unauthenticated attacker can exploit this by first completing a legitimate Firebase OTP verification with their own phone number, obtaining a valid Firebase session. Then, in a request to lwp_ajax_register, they supply the victim's phone number (e.g., an administrator's) along with their own Firebase session token. The plugin does not cross-check that the Firebase session's phone number matches the supplied phone number, causing the victim's account to be authenticated [2][4].

Impact

Successful exploitation allows an attacker to authenticate as any WordPress user who has a phone number stored in user meta, including administrators. This grants attacker full access to the compromised account, potentially leading to complete site takeover, data disclosure, and further compromise.

Mitigation

As of the publication date, no patch has been released. Affected users should disable the plugin or remove the vulnerable code until a fix is available. No workaround is provided. The plugin is not listed in the CISA KEV.